CVE-2026-124435

OpenRemote versions before 1.32.2 are vulnerable to a stored cross-site scripting (XSS) vulnerability. The flaw exists in the Manager configuration file upload endpoint , where authenticated users with write:admin permissions can upload HTML or SVG files containing malicious JavaScript. Attackers...

CVE-2026-124435: openremote core: OpenRemote before 1.32.2 contains a stored cross-site scripting vulnerability that allows authenticated users with…

OpenRemote before 1.32.2 contains a stored cross-site scripting vulnerability that allows authenticated users with write:admin permissions to upload HTML or SVG files containing JavaScript via the Manager configuration file upload endpoint. Attackers can lure victims to the unauthenticated image...

PT-2026-123025

OpenRemote before 1.31.0 contains an authorization bypass vulnerability that allows realm admins to impersonate gateways in other realms because GatewayService only checks the gateway ID, not the realm. Attackers with WRITE:ADMIN in one realm can create a service user named after another realm's...

CVE-2026-73616: Authorization Bypass Through User-Controlled Key

OpenRemote notification deletion endpoints fail to enforce realm boundaries, allowing any realm administrator to delete notifications belonging to other realms. Attackers with write:admin role in one realm can send DELETE requests to remove notifications from the master realm or other tenants...